Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“GDPR compliant” analytics is probably violating GDPR

pilcrow.vercel.app

Post reply on HN
Print view View original

11–20 of 86 posts

Re: “GDPR compliant” analytics is probably violating GDPR

#11

Post by superkuh »

shadowgovt wrote: post #4

I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space. When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegall…

What I miss the most, and where the most damage to the net has been done so far, is in terms of whois. Without WHOIS it's become near impossible to contact people. Before you'd find an interesting domain, whois, email 'em up. Now that GDPR has made whois illegal, or a high enough legal risk that registrars are chosing to turn it off, there's no way to contact any arbitrary domain. It's made the web a lot more impersonal and corporate.

Re: “GDPR compliant” analytics is probably violating GDPR

#12

Post by dalben »

I am a SWE (IANAL) with a post-grad degree in GDPR/DPO, and while I had only time for a cursory read, I must say it hits a lot of nails on the head! A breath of fresh air in times of so much GDPR misinformation.

From what I remember, the ePrivacy-GDPR cookie mismatch (consent as the only allowed legal basis for cookies) is due to ePrivacy being older than the GDPR and not intentional.

Article 5 (Principles) is always a good mention - just having a legal basis is not enough, you always need to respect these principles (such as lawfulness, fairness and transparency).

The dig at pseudonomyzation not being enough is great. It's a personal pet peeve of mine. Pseudonomized data is still personal data!

The GDPR does not prescribe how to anonymize data. It just says "as long as someone can identify a person, then it's personal data." For example, you might think that aggregating based on city is enough to anonymize, but my nephew was at one point the sole person living in a village - that would have directly identified him. Likewise, stripping the last octet of IP addresses might not be enough if I personally own a /24. It's all about context.

The biggest thing I personally learned, was that any solution claiming to be "GDPR proof" probably is not compliant.

Re: “GDPR compliant” analytics is probably violating GDPR

#13

Post by rrdharan »

shadowgovt wrote: post #7
Nextgrid wrote: post #5

Earlier quoted context omitted.

The Apache logging can fall under legitimate interest for security/fraud prevention/debugging purposes, as long as it's kept for a reasonable duration (I keep mine for 3 months) and is not used for any other purpose such as marketing or analytics.

Is it not incumbent upon the admin to prove they didn't use the data for analytics? If so, that makes the data default-radioactive where before GDPR it was legally harmless. And what is "analytics" exactly? If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics?

> If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics?

Yes.

However enforcement is intentionally discretionary and selective and hence sensitive / prone to political, protectionist and sentimental whims. Your 1 person outfit in Europe is less likely to suffer in actual court, or the court of public opinion, than a big bad American tech company will.

Re: “GDPR compliant” analytics is probably violating GDPR

#14

Post by fogzen »

chrismorgan wrote: post #8
fogzen wrote: post #6

I don’t get it. Why not just set a 24-hour cookie scoped to the path, and every request without the cookie is logged as a “unique visit”. That gives unique visits by device within a 24 hour period, per page, with no logging of any ID/IP whatsoever. You can pair this with signup counts or campaign codes to get conversion rate by channel, all without any nonsense “anonymized” user IDs.

ePrivacy Directive says you can’t store that cookie without consent (since it’s not in any way essential). More generally: analytics mustn’t rely on storing anything on the user’s device for its functionality; that’s why people head in the direction of fingerprinting.

I didn’t realize that. That seems pretty stupid. The system I describe doesn’t log any personally identifiable information.

Re: “GDPR compliant” analytics is probably violating GDPR

#15

Post by gizmo »

shadowgovt wrote: post #4

I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space. When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegall…

Making companies liable for the data they collect is a very good thing. Before GDPR logging everything was the default. Now, every business has to think about what data they collect, what purpose it serves, which parties the data is shared with, and when the data will be deleted.

GDPR, like any big new law, has plenty of weird unintended consequences. But it’s a major step forward for privacy and consumer data rights regardless.

Re: “GDPR compliant” analytics is probably violating GDPR

#16

Post by gizmo »

spacebanana7 wrote: post #10
Nextgrid wrote: post #5

Earlier quoted context omitted.

The Apache logging can fall under legitimate interest for security/fraud prevention/debugging purposes, as long as it's kept for a reasonable duration (I keep mine for 3 months) and is not used for any other purpose such as marketing or analytics.

Defaults matter. Unless configured otherwise most logs are permanent and exist just because they might be useful sometime in the future.

And those defaults must be changed. GDPR rightly forces businesses to reconsider hoarding data because it “might be useful sometime in the future”.

Re: “GDPR compliant” analytics is probably violating GDPR

#17

Post by chrismorgan »

superkuh wrote: post #11
shadowgovt wrote: post #4

I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space. When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegall…

What I miss the most, and where the most damage to the net has been done so far, is in terms of whois. Without WHOIS it's become near impossible to contact people. Before you'd find an interesting domain, whois, email 'em up. Now that GDPR has made whois illegal, or a high enough legal risk that registrars are chosing to turn it off, there's no way to contact any arbitrary domain. It's made the web a lot more imperso…

Eh, I never had much success with at least corporate whois email addresses even before they started being effectively removed (by registrars masking them, years before GDPR). Even addresses like postmaster@ which are mandated by the SMTP spec (RFC 5321 §4.5.1 and other places) don’t tend to work.

Re: “GDPR compliant” analytics is probably violating GDPR

#18

Post by Hitton »

fogzen wrote: post #6

I don’t get it. Why not just set a 24-hour cookie scoped to the path, and every request without the cookie is logged as a “unique visit”. That gives unique visits by device within a 24 hour period, per page, with no logging of any ID/IP whatsoever. You can pair this with signup counts or campaign codes to get conversion rate by channel, all without any nonsense “anonymized” user IDs.

You can do basically this without cookies with daily random salt (which is not stored longterm) added to the ip + useragent hash mentioned in the article.

Re: “GDPR compliant” analytics is probably violating GDPR

#19

Post by frereubu »

fogzen wrote: post #14
chrismorgan wrote: post #8

Earlier quoted context omitted.

ePrivacy Directive says you can’t store that cookie without consent (since it’s not in any way essential). More generally: analytics mustn’t rely on storing anything on the user’s device for its functionality; that’s why people head in the direction of fingerprinting.

I didn’t realize that. That seems pretty stupid. The system I describe doesn’t log any personally identifiable information.

In the article they point out that anything that can be used to identify one click and link it to a subsequent click - in your example the cookie - is considered person hall data. This is because you may be able to de-anonymise a person from the pattern of their interactions.
Post reply on HN